Cyber Posture

CVE-2025-15518

HighRCE

Published: 23 March 2026

Published
23 March 2026
Modified
31 March 2026
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 26.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15518 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Archer Nx200. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Network Device CLI (T1059.008). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires input validation mechanisms at CLI entry points to block crafted inputs from enabling OS command injection.

prevent

Mandates timely identification, reporting, and correction of flaws like this command injection vulnerability through firmware updates.

prevent

Ensures receipt and implementation of vendor security advisories directing firmware updates to remediate this specific vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
Why these techniques?

Direct OS command injection in administrative network device CLI enables arbitrary command execution via T1059.008.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands…

more

on the operating system, impacting the confidentiality, integrity, and availability of the device.

Deeper analysisAI

CVE-2025-15518 involves improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500, and NX600 routers. This flaw allows crafted input to be executed as part of an operating system command, enabling OS command injection as defined by CWE-78. Published on 2026-03-23, the vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

An authenticated attacker possessing administrative privileges can exploit this vulnerability remotely over the network with low attack complexity and without requiring user interaction. Exploitation grants the ability to execute arbitrary operating system commands on the device, thereby impacting its confidentiality, integrity, and availability.

TP-Link advisories recommend mitigation through firmware updates available on their support download pages for the Archer NX200, NX210, NX500, and NX600 models. Further guidance is provided in the support FAQ at https://www.tp-link.com/us/support/faq/5027/.

Details

CWE(s)

Affected Products

tp-link
archer nx600 firmware
≤ 1.3.0 · ≤ 1.3.0 · ≤ 1.4.0
tp-link
archer nx500 firmware
≤ 1.5.0 · ≤ 1.3.0
tp-link
archer nx210 firmware
≤ 1.3.0 · ≤ 1.3.0
tp-link
archer nx200 firmware
≤ 1.3.0 · ≤ 1.3.0 · ≤ 1.8.0

CVEs Like This One

CVE-2025-15519Same product: Tp-Link Archer Nx200
CVE-2026-22224Same vendor: Tp-Link
CVE-2025-15605Same product: Tp-Link Archer Nx200
CVE-2026-22222Same vendor: Tp-Link
CVE-2025-15517Same product: Tp-Link Archer Nx200
CVE-2026-30815Same vendor: Tp-Link
CVE-2026-0631Same vendor: Tp-Link
CVE-2026-3841Same vendor: Tp-Link
CVE-2025-6542Same vendor: Tp-Link
CVE-2026-22221Same vendor: Tp-Link

References